High-Tech Sector Identified as Top Cyber-Attack Target for 2025, Replacing Finance
Summary
Hide ▲
Show ▼
In 2025, the high-tech sector became the most targeted industry for cyber-attacks, comprising 17% of Mandiant’s incident response investigations, surpassing financial services which held the top position in 2023 and 2024. The shift is highlighted in Mandiant’s M-Trends 2026 Report, published on March 23, 2026. The global median dwell time for intrusions increased from 11 days in 2024 to 14 days in 2025, with North Korea-linked espionage and IT worker scam campaigns exhibiting median dwell times of 122 days. Threat actors increasingly leveraged native system functionalities and legitimate tools to evade detection while focusing on recovery denial objectives in ransomware operations.
Timeline
-
23.03.2026 17:35 1 articles · 3h ago
High-Tech Sector Designated as Top Cyber-Attack Target in 2025, Marking Shift from Finance
The high-tech sector accounted for 17% of Mandiant’s 2025 incident response investigations, surpassing financial services (14.6%) as the most targeted industry. The global median dwell time for intrusions increased to 14 days in 2025, with North Korea-linked campaigns exhibiting dwell times of 122 days. Vishing surged to 11% of initial access vectors, while vulnerability exploits remained the leading vector (32%). Ransomware operators shifted objectives to recovery denial, targeting critical infrastructure components.
Show sources
- High-Tech Sector Overtakes Finance as Top Target for Cyber-Attacks, Mandiant Reports — www.infosecurity-magazine.com — 23.03.2026 17:35
Information Snippets
-
The high-tech sector accounted for 17% of all Mandiant investigations in 2025, surpassing financial services (14.6%) which had been the top target in 2023 and 2024.
First reported: 23.03.2026 17:351 source, 1 articleShow sources
- High-Tech Sector Overtakes Finance as Top Target for Cyber-Attacks, Mandiant Reports — www.infosecurity-magazine.com — 23.03.2026 17:35
-
The global median dwell time for intrusions rose from 11 days in 2024 to 14 days in 2025, driven primarily by North Korea-linked cyber espionage campaigns and IT worker scam incidents, both with median dwell times of 122 days.
First reported: 23.03.2026 17:351 source, 1 articleShow sources
- High-Tech Sector Overtakes Finance as Top Target for Cyber-Attacks, Mandiant Reports — www.infosecurity-magazine.com — 23.03.2026 17:35
-
Mandiant and Google Threat Intelligence Group (GTIG) identified 83 malicious cyber campaigns and eight global cyber events in 2025, affecting organizations across 73 countries.
First reported: 23.03.2026 17:351 source, 1 articleShow sources
- High-Tech Sector Overtakes Finance as Top Target for Cyber-Attacks, Mandiant Reports — www.infosecurity-magazine.com — 23.03.2026 17:35
-
Threat actors increasingly abused native functionalities in on-premises and cloud environments as well as legitimate tools to reduce detection opportunities in 2025 incidents.
First reported: 23.03.2026 17:351 source, 1 articleShow sources
- High-Tech Sector Overtakes Finance as Top Target for Cyber-Attacks, Mandiant Reports — www.infosecurity-magazine.com — 23.03.2026 17:35
-
The ClickFix social engineering technique gained significant traction in 2025, with dozens of threat clusters employing phishing lures such as CAPTCHAs, video conference verifications, driver updates, and enterprise software compliance checks to execute PowerShell or system-level commands.
First reported: 23.03.2026 17:351 source, 1 articleShow sources
- High-Tech Sector Overtakes Finance as Top Target for Cyber-Attacks, Mandiant Reports — www.infosecurity-magazine.com — 23.03.2026 17:35
-
Vulnerability exploits remained the most common initial infection vector (32% of identifiable cases), while voice phishing (vishing) surged to 11%, surpassing email phishing which declined to 6% in 2025.
First reported: 23.03.2026 17:351 source, 1 articleShow sources
- High-Tech Sector Overtakes Finance as Top Target for Cyber-Attacks, Mandiant Reports — www.infosecurity-magazine.com — 23.03.2026 17:35
-
Ransomware operators shifted their primary objective from data theft to deliberate recovery denial, targeting backup infrastructure, identity services, and virtualization management planes in 2025.
First reported: 23.03.2026 17:351 source, 1 articleShow sources
- High-Tech Sector Overtakes Finance as Top Target for Cyber-Attacks, Mandiant Reports — www.infosecurity-magazine.com — 23.03.2026 17:35
-
In 2025, Mandiant began tracking 661 new threat clusters and 714 new malware families, bringing the total tracked to over 5,000 clusters and 6,000 malware families.
First reported: 23.03.2026 17:351 source, 1 articleShow sources
- High-Tech Sector Overtakes Finance as Top Target for Cyber-Attacks, Mandiant Reports — www.infosecurity-magazine.com — 23.03.2026 17:35